I am looking at our patch management control for SQL Server databases and until now the process only requires us to install security patches. Microsoft releases cumulative updates every month and it has got fixes for bugs and we have not installed these CU's unless we have hit a bug address in the CU or we think a bug fix for performance issue might help us.

During the last audit, the auditors asked us why we haven't installed the CU's.

Now my question is, does anything in SOC tell us to install anything other than security fixes? CU's contain bugfixes/improvements etc and I am not sure if SOC 1 or 2 defines those or the auditors were mistaken. Isn't it similar to asking us why we haven't installed the latest version of SQL Server?


1 Answer 1


Your question does not say that the assessors are requiring non-security patches, they are just asking why you have not installed the CUs.

For Security, CU's include security updates. If I was assessing you, I'd ask the same question. How can you be sure, and how do you assure, that when you install individual security patches that you have patched everything that a CU does?

For Availability and Processing Integrity, non-security bug fixes are also important for maintaining that the system will meet contractual agreements. If there is a bug and you're not fixing it, then you risk your stakeholder's expected function of the system. Again, it's not about the CU but about applying the available fixes to ensure consistent and available operation.

CC8.1 Change Management:

The entity authorizes, designs, develops or acquires, configures, documents, tests, approves, and implements changes to infrastructure, data, software, and procedures to meet its objectives.


Identifies Changes in Infrastructure, Data, Software, and Procedures Required to Remediate Incidents — Changes in infrastructure, data, software, and procedures required to remediate incidents to continue to meet objectives are identified and the change process is initiated upon identification.


PI1.3 The entity implements policies and procedures over system processing to result in products, services, and reporting to meet the entity’s objectives.

Detects and Corrects Production Errors — Errors in the production process are detected and corrected in a timely manner.


This doesn't mean that you must apply all possible patches, whether security-related or not, but that you should have a process in place to 1) know that a patch exists, and 2) evaluate whether you need to apply the patch to meet business objectives.

So, the question: "why don't you install these patches?" is valid and expected and you should have an answer. It is ultimately up to you, your business case, and your contracts to determine whether the patch is applied.

My experience: I was the security architect who led an SaaS through their first SOC 2 Type 2.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .